Wireshark 4.6.8 fixes 28 security bugs in the protocol analyzer, and nine of them fire when someone opens a saved capture file. Those nine sit in file parsers, the code that reads a capture off disk before any dissection begins: pcapng, Endace ERF, Tektronix K12xx, BUSMASTER, Catapult DCT2000, Gammu DCT3, 3gpp phone logs, TTX Logger, and, on Windows only, Ixia IxVeriWave and Vector Informatik BLF. An attacker never has to touch your network for these. They only have to get you the file.
The full set runs from advisory wnpa-sec-2026-64 to wnpa-sec-2026-91, and dissectors account for most of it. A dissector is the per-protocol code that turns raw bytes into the labeled fields in the packet detail pane, and this release fixes crashes in RDP, SSH, Kerberos, H.245, ESS, X.509IF, RRC, and UMTS FP, plus two separate advisories each for CMS and C12.22 and four covering Bluetooth ATT, HFP, BR/EDR FHS, and AVRCP.
One more lands in the reassembly engine, which every dissector relies on to stitch fragmented data back together. Two crash sharkd rather than the GUI, so anything scripted on top of that utility is exposed on the same input.
Several fixes came out of the project’s own fuzz jobs, so the count reflects testing volume as much as anything else. The prior release, 4.6.7, carried 12 advisories.
Memory-safety fixes without advisory numbers
Not everything dangerous in this release got a wnpa identifier. The bug list includes a stack buffer overflow in the K12/RF5 writer, a stack over-read in the Sniffer REC_HEADER2 error path, an out-of-bounds read in androiddump from a signed btsnoop length, an out-of-bounds read in the BLF writer on truncated VLAN-tagged frames, and stack exhaustion from deeply nested NetLog JSON and from recursion in the DLMS/COSEM compact-array parser. If you track exposure by advisory count, you will undercount this release.
Eight 5G fields were decoded wrong
Wireshark misdecoded the S-NSSAI location validity information, NSAG information, UE security capability, Registration wait range, and Extended CAG information elements in 5G NAS, along with the SOR transparent container, its SOR-CMCI field, and the service level AA container in 5GSM. Nothing crashed. The screen just showed the wrong values, which is the harder failure to notice, because a mobile core engineer reading a UE security capability field has no reason to doubt it.
An extcap path moved in 4.6.0 and the notes say so now
On UN*X systems, Wireshark looks for extcap binaries under /usr/libexec/wireshark/extcap
instead of /usr/lib64/wireshark/extcap
or similar. Third-party extcaps may need packaging changes, and WIRESHARK_EXTCAP_DIR
overrides the location. Distributions without a libexec directory, such as Alpine Linux, keep the old path. This took effect in 4.6.0, eight point releases back, and appears in the release notes for the first time here.
Windows users get two nuisance fixes as well: Capture File Properties has been slow enough to hang the application since 4.6.6, and toggling the TCP preference “Analyze TCP sequence numbers” segfaulted.